The keithbaileys npm package, a fork of the Baileys WhatsApp Web library, contains injected code that issues an authenticated 'w:mex' FOLLOW query upon connection. This query subscribes the victim's WhatsApp account to attacker-chosen channels using the victim's own authenticated session. The target channel JIDs are obfuscated through various techniques or fetched dynamically from attacker-controlled remote sources, allowing the attacker to change targets post-installation. The malicious behavior is consistent across a family of over 100 near-identical forks, differing only in package name, obfuscation, and delivery method. The code does not steal credentials, maintain persistence, or run arbitrary code remotely.

Victims unknowingly subscribe to attacker-controlled WhatsApp channels, potentially exposing them to unwanted content or spam. The attack leverages the victim's authenticated session but does not compromise credentials or allow remote code execution. There is no persistence or credential exfiltration involved.

No official patch or remediation is indicated in the provided data. Users should avoid installing or using the affected versions (1.0.8, 1.1.0, 1.1.1) of the keithbaileys package. Review and verify the integrity of npm packages before installation. Monitor for updates or advisories from the package maintainers or npm registry regarding this issue.